aiqbench analysis
GitLab 19.1 introduces an enterprise-grade AI agent capable of automatically triaging secret detection false positives using contextual reasoning and confidence scoring. This feature directly addresses alert fatigue by integrating LLM analysis into the vulnerability workflow, allowing security teams to focus on genuine high-severity risks without manual intervention. The release also establishes centralized governance controls for mandatory AI usage across projects, marking a significant step in operationalizing AI for DevSecOps compliance.
GitLab 19.1 release notes
On June 18, 2026, GitLab 19.1 was released with the following features. We’d also like to announce this month’s Notable Contributor: Pishel65! We are excited to recognize Pishel65, a Level 3 contributor with 19 merged MRs and 9 more open since joining in October 2025. Primary features Secret false positive detection with GitLab Duo Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Secret false positive detection with the GitLab Duo Agent Platform is now generally available. Security teams spend significant time investigating secret detection findings that are incorrectly flagged as actual secrets. These false positives create alert fatigue, erode trust in scan results, and divert attention from genuine security risks. When a security scan runs, GitLab Duo automatically analyzes each critical and high severity secret detection vulnerability to determine if it is a false positive. The AI assessment appears in the vulnerability report, so you have immediate context for faster and more confident triage decisions. Key features include: Automatic analysis: Runs after each security scan without manual trigger. Manual trigger: Trigger false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Analyze only critical and high severity vulnerabilities to maximize signal-to-noise improvement. Contextual AI reasoning: Each assessment includes an explanation of why the finding is likely a true positive, based on code context and vulnerability characteristics. Confidence scoring: Each detection includes a confidence score to help teams prioritize review based on the model’s certainty. Seamless workflow integration: Results appear directly in the vulnerability report alongside existing severity, status, and remediation information. We welcome your feedback in issue 592861. Always on availability mode for GitLab Duo Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue Administrators can now set GitLab Duo to be always on for all projects in an entire instance or top-level group. When GitLab Duo is set to always on, group, subgroup, and project owners cannot turn off GitLab Duo, giving enterprises centralized AI governance for compliance and regulated environments. This new setting is symmetrical to the existing always off setting, closing a gap where GitLab Duo could be locked off but could not be locked on. This new setting is especially valuable for organizations with autonomous divisions or subsidiaries that need to guarantee consistent AI tooling across the business. To set GitLab Duo to be always on, go the instance or top-level group GitLab Duo settings and set GitLab Duo availability to Always on. Automatically assign Code Owners as reviewers Tier: Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated Links: Documentation · Related Issue Previously, you needed to select reviewers for each merge request manually, even when a CODEOWNERS file already defined who should review each file. You can now configure a project to assign Code Owners as reviewers automatically. GitLab assigns every Code Owner that matches the changed files. This happens when a merge request is created in a ready state, or when a draft is marked ready. If you already assigned a reviewer, GitLab skips automatic assignment and keeps your choice. To turn on automatic reviewer assignment, go to Settings > Merge requests > Automatic reviewer assignment and select Automatically assign all code owners as reviewers. Compliance framework templates (beta) Tier: Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue You can now create compliance frameworks from predefined templates. Previously, building a compliance framework required defining every requirement and control by hand, a repetitive process when a framework had dozens of controls. Now, when you create a new framework in the Compliance center, you can: Select Create from template to start from a preconfigured framework with requirements and controls already in place. Preview each template, customize the name, description, and color, and then apply it to your group in a single step. 19 templates are available, including ISO 27001:2022, SOC 2, FedRAMP, NIST, CIS, TISAX, and more. Improved secret detection coverage for feature branch pipelines Tier: Free, Premium, Ultimate Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated, GitLab Dedicated for Government Links: Documentation · Related Issue In GitLab versions earlier than 19.1, you couldn’t trust a feature branch pipeline to surface every secret in your branch. A new branch scanned only the latest commit. An existing branch s
On June 18, 2026, GitLab 19.1 was released with the following features. We are excited to recognize Pishel65, a Level 3 contributor with 19 merged MRs and 9 more open since joining in October 2025. Secret false positive detection with the GitLab Duo Agent Platform is now generally available. Security teams spend significant time investigating secret detection findings that are incorrectly flagged as actual secrets. These false positives create alert fatigue, erode trust in scan results, and divert attention from genuine security risks. When a security scan runs, GitLab Duo automatically analyzes each critical and high severity secret detection vulnerability to determine if it is a false positive. The AI assessment appears in the vulnerability report, so you have immediate context for faster and more confident triage decisions. Automatic analysis: Runs after each security scan without manual trigger. Manual trigger: Trigger false positive detection for individual vulnerabilities on the vulnerability details page for on-demand analysis. Focus on high-impact findings: Analyze only critical and high severity vulnerabilities to maximize signal-to-noise improvement. Contextual AI reasoning: Each assessment includes an explanation of why the finding is likely a true positive, based on code context and vulnerability characteristics. Confidence scoring: Each detection includes a…
Excerpt shown under the publisher's RSS terms · 200 words · full text and figures are on the publisher's site
